InfoSecBulletin Cybersecurity for mankind
TP-Link has revealed several serious security flaws in Aginet networking products managed by ISPs. This includes mesh systems, routers, PON devices, and xDSL modems.
The flaws might let attackers who can connect to the network get around checks, gain higher access, steal important data, look at device files, and run system commands.
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
Anthropic prepares “Claude Money” to analyze bank account and financial data
GhostCode Phishing Kit Evades Microsoft 365 MFA to Hijack Accounts in 78 Seconds
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
The security notice, updated on August 10, 2026, lists problems as CVE-2025-30237 to CVE-2025-30241. Internet service providers usually supply, set up, and update the affected products, so firmware may change depending on the provider and area.
The main flaw, CVE-2025-30237, is a way to get around logging in on the web management page. It has a CVSS v4 score of 8.7 and happens because of failed access rules on some links.
An attacker on a nearby network can send special requests to access important functions without login details. If this happens, the attacker could take complete control of the device.
| CVE | Vulnerability | Severity |
|---|---|---|
| CVE-2025-30237 | Authentication bypass | High |
| CVE-2025-30238 | Privilege escalation | High |
| CVE-2025-30239 | Sensitive data exposure | High |
| CVE-2025-30240 | Arbitrary file read | Medium |
| CVE-2025-30241 | OS command injection | High |
Multiple TP-Link Flaws
CVE-2025-30238, rated 8.6, is a mistake in user-management that lets low-level users do admin tasks. This means they might create special accounts or change important settings. An attacker with little access could gain more control over a router or mesh node.
Another high-severity issue, CVE-2025-30239, involves hardcoded cryptographic keys stored in firmware. The vulnerability has a CVSS score of 8.5.
An attacker with access to the device’s storage could recover the embedded keys and decrypt protected configuration data. Exposed information may include credentials and ISP-related service settings, creating a risk of further compromise.
CVE-2025-30240 is a medium-severity arbitrary file-read issue with a CVSS score of 5.1. The flaw affects the USB HTTPS access path and stems from improper handling of symbolic links on external USB storage.
A person who can physically reach the device might make a harmful symbolic link on a supported device and use it to get to important files in the router’s system.
The last flaw, CVE-2025-30241, is a serious flaw that lets attackers run commands on the OS. It has a high danger level of 8.6. This happens because some web parts do not check user input correctly before sending it to system commands.
An attacker on the local network could send commands and run them with higher access, possibly gaining full control of the device. The affected devices are from TP-Link’s HB, HX, HC, EB, EC, EX, XC, XX, and VX series.
HB810, HB710, EX220, EX222, EX920, EC220-G5, XX530v, and VX1800v are some examples. The effect varies based on the model for the area, hardware type, ISP changes, and the firmware installed.
TP-Link said that fixing ISP-managed devices will be done with the help of service providers. Often, updates can be installed automatically using ISP management tools.
Users need to look at the router’s admin page or the provider’s app for firmware updates. If there is no update, customers should reach out to their ISP to see if their device is impacted and when a fix will be available.
Users should limit access to management tools because some problems need local or nearby network access. They should use strong, different passwords for administrators, disable unneeded remote management options, and keep untrusted users away from the local network.
